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U PDATE ON 1989 FAX GUIDELINES 


1. INTRODUCTION 


Aa Background 


In June of 1989, the Office of the Information and 
Privacy Commissioner/Ontario (IPC) issued a set 
of guidelines for government institutions to con- 
sider when developing systems and procedures to 
maintain the confidentiality of information trans- 
mitted by facsimile (commonly referred to as “fax”’). 
This document was entitled “Guidelines on Fac- 
simile Transmission Security” (Guidelines). These 
Guidelines were issued to all institutions in Ontario 
that fell under the jurisdiction of the Freedom of 
Information and Protection of Privacy Act, 1987, as 
amended, (Act). 


The response to the IPC Guidelines was extremely 
positive and hundreds of requests for the Guide- 
lines were received from both Canadian and Ameri- 
can organizations, in both the public and private 
sectors. 


Effective January 1, 1991 all municipalities, agen- 
cies, local boards and commissions in Ontario will 
be required to comply with the Municipal Freedom 
of Information and Protection of Privacy Act, 1989. 
It is estimated that approximately, 3,000 institu- 
tions will be required to comply with this statute. 
Consequently, over 3,300 institutions in Ontario 
will be required to comply with provincial privacy 
regulations. 


Primarily due to its great speed and convenience, 
the use of fax machines continues to proliferate. 
Based upon the results of a survey conducted by the 
IPC in March of 1990, we learned that 83 provincial 
government institutions made use of approximately 
2,052 fax machines. 


At the time of the its release, the IPC had decided 
to update the Guidelines in roughly one year. Taking 
these factors into consideration, the IPC chose to 
review its Guidelines in the spring of 1990. 


1.2 Objectives of This Document 


The purpose of this document is to review the 
Guidelines issued in 1989, to ensure that they are 
still appropriate in the context of generally avail- 
able fax technology, and to provide an update of any 
new security-related developments. 


1.3 Approach and Scope 


A) The IPC decided to conduct a survey of the 
majority of provincial institutions that were 
issued the original Guidelines. The main 
objective of the survey was to obtain feed- 
back trom these institutions in order to 
assess how useful they found the Guide- 
lines in their use of fax machines. 


B) The Guidelines themselves were reviewed 
to ensure that they were still appropriate in 
the context of generally available fax tech- 
nology. Any significantly new security fea- 
tures that are now generally available and 
that could assist in implementing the Guide- 
lines, will be identified. 


Itis not the intention of this document to identify all 
the new fax-related products available. Nor do we 
intend to recommend or favour any particular prod- 
uct, brand name or vendor. 


2. SURVEY OF INSTITUTIONS 


2.1 Methodology 


Most institutions under the jurisdiction of the Act 
were sent a fax survey questionnaire. Some institu- 
tions did not have their own fax machines, but used 
the services of an affiliated or related institution. In 
those instances, the office procedures of the affili- 
ated or related institution were complied with. 


The following is asummary of the survey responses: 


INSTITUTIONS 
No. % 
Responded 83 53 
Responded, but did not 
have own fax machine a2 15 
No response 134 54 
249 100 


Table 1 presents the distribution of fax machines 
among the institutions that responded to our survey 
questionnaire. Over half of these institutions had 
between one and four fax machines each. A quarter 
of the institutions fell into the category of having 20 
or more fax machines. 


2.2 Policies 


Only 40% of the institutions that replied stated that 
they had a formal policy regarding the use of their 
fax machine (see Table 2). A number of these 
institutions replied that they had adopted the IPC 
guidelines. Some of the institutions which indi- 
cated they did not have a policy, stated that they 
were in the process of developing such a policy. 


We considered institutions in the category of hav- 
ing 20 or more fax machines each, as a significant 
group. Among such institutions, 33% had a fax 
policy compared to the overall average of 40% for 
the entire group (Table 2). In light of the prolifera- 
tion of fax machines, institutions should develop a 
policy on the use of fax machines in their organiza- 
tion (especially those with a significant number). 


2.3 Office Procedures 


Over half of the institutions replied that they had 
reviewed existing office procedures involving fax 
transmissions as a result of the IPC Guidelines (see 
Table 3). Others replied that they were in the 
process of doing so. Some institutions were un- 
aware of the security implications of fax transmis- 
sions, while to others, the IPC Guidelines rein- 
forced their concerns over the security of such 
transmissions. Eighty-four percent of the institu- 
tions that responded stated that the Guidelines 
were useful as a reference document for designing 
new procedures (see Table 4). Thirty-eight percent 
of the larger institutions (with 20 or more fax ma- 
chines) indicated that the Guidelines had triggered 
them to review their security in other areas as well, 
such as local area networks of computers (see 
Table 5). Reviewing overall security ina number of 
areas appears to be an ongoing process. 


2.4 Security Features 


Over one-third of the institutions responded that 
the Guidelines had caused them to review existing 
features on their fax machines (see Table 6). Some 
of the institutions indicated that they had not done 
so because they were already aware of the security 
problems associated with fax transmissions. It is 
encouraging to note that over half of the institu- 
tions with 20 or more fax machines had done so. 
Some institutions indicated that such a review was 
scheduled to be conducted in the near future. Forty- 
one percent ofall institutions found the IPC Guide- 
lines to be a useful reference for specifying features 
when ordering new fax machines or upgrading their 
existing ones (see Table 7). The most common 
security features used by institutions were confi- 
dential mailboxes and the placement of fax ma- 
chines in secure locations. 


2.5 Third Party Communication 


Thirty percent of the institutions that replied esti- 
mated that over half of their fax activity was with 
third parties (see Table 8). Some were unable to 
make this estimate in time for our survey. We 
defined third parties as those organizations that are 
not required to comply with Ontario’s access and 
privacy legislation. Institutions with the major por- 
tion of their fax activity transmitted to third parties 
have an additional responsibility to ensure that 
personal information is faxed securely. Once trans- 
mitted outside of the Act’s jurisdiction, such infor- 
mation can no longer be protected by the Act. 


3. REVIEW OF 1989 FAX GUIDELINES 


3.1 Technology 


It is our opinion that encrypting or encoding infor- 
mation is the most effective means of protecting it 
from being intercepted and read by unauthorized 
persons, during electronic transmissions. 


The practical problems that existed with encryption 
in the past, still remain. Fax machines that have 
internal encryption devices may only transmit en- 
crypted information to identical fax machines in the 
user group. External encryption devices are now 
available which can be attached to a fax machine. 
However, this solution still requires that the identi- 
cal encryption device be available on all fax ma- 
chines in the user group. 


An additional problem with encryption is the need 
for a special code or encryption key which must be 
generated and distributed to all fax encryptors in 
the user group. The encryption key must be distrib- 
uted by a secure method such as by courier. This 
procedure must be followed each time that the key 
is changed. This practical problem of encryption 
key management has now been resolved through 
the availability of encryption devices which use 
automatic encryption and key management tech- 
niques. 


The Guidelines recognized that encrypted infor- 
mation could also be transmitted between comput- 
ers and then decrypted or decoded at the receiving 
computer. The practical problem identified in us- 
ing this procedure, namely that all the information 
required to be faxed may not be stored on the com- 
puter, still remains. For example, records such as 
the minutes of meetings, correspondence, or hand- 
written notes, may not be stored on the sender’s 
computer. 


Thus, under existing commercially available fax 
technology, encryption still does not appear to be a 
satisfactory solution for most “normal” situations. 
Where practical, however, we encourage consid- 
eration of its use when faxing very sensitive per- 
sonal information, since it remains the most secure 
method of transmission. 


In February of 1990, Ontario’s Management Board 
of Cabinet issued, “A Directive For The Manage- 
ment Of Information Technology Security”. One 
of its purposes was to ensure that ministries safe- 
guarded the confidentiality, integrity and availabil- 
ity of their data while it was created, stored, proc- 
essed or communicated through information tech- 
nology, including fax machines. One of the prin- 
ciples specified in this document was that: “Infor- 
mation technology security is to be consistent with 
the privacy and confidentiality requirements of the 
Freedom of Information and Protection of Privacy 
Act.” This indicates that privacy principles will form 
a key component on information technology secu- 
rity developments in the public sector, and is consis- 
tent with the Guidelines established by the IPC for 
the use of fax technology. 


3.2 Capabilities of Fax Machines 

Our Guidelines identified three existing features 
on fax machines that would provide certain levels of 
control over fax transmission security: 

- Keylocks; 

- Confidential Mailboxes; and 


- Activity Confirmation Reports. 


Existing capabilities of fax machines have not fun- 
damentally changed in the area of transmission 
security. Therefore, the features identified above 
still remain. We refer readers to the 1989 Guide- 
lines for a detailed description of the above con- 
trols. 


3.3 User Procedures 


Like telephone conversations, fax transmissions may 
be “tapped” or intercepted. Practically, however, 
the major security risk is that the sender will dial an 
incorrect fax number or that the faxed message will 
not be delivered to the intended recipient. In order 
to control for this risk (absent the security measures 
associated with fax machines discussed earlier), 
secure fax transmissions are largely dependant on 
having adequate policies and user procedures, while 
utilizing the existing features on the machine to 
their utmost. Adequate user procedures formed 
the fundamental premise underlying our original 
Guidelines, and continue to do so at present. 


In the following section, we wish to apprise readers 
of possible practices used by other institutions and 
organizations to enhance their fax transmission 
security. 


There are certain situations where personal infor- 
mation must be faxed by an institution because the 
personal identifiers cannot be removed. Often, the 
destination fax does not have a confidential mail- 
box. In situations such as these, institutions should 
alert the recipient with a telephone call prior to the 
transmission, that such information is about to be 
faxed and to await its receipt. Once received, the 
recipient should confirm receipt by telephone. 


Fax machines use specially treated thermographic 
or heat-printed paper to record incoming messages. 
After anumber of years, thermographic paper tends 
to be unreadable, leading to the loss of the informa- 
tion recorded on it. Institutions should photocopy 
information printed on thermographic paper in 
order to preserve the information contained therein 
long enough to correspond with its retention pe- 
riod. The thermographic paper may then be de- 
stroyed in a secure manner. Messages printed on 
fax machines using thermal ink transfer or equipped 
with laser printers would not have this problem 
since thermographic paper is not used. 


Institutions may receive fax messages after normal 
office hours. During this time, security may be lax 
and only staff of certain departments such as data 
processing may be in the office. Under such condi- 
tions, some institutions identify and isolate a spe- 
cific fax machine to receive messages after normal 
office hours. Such a fax machine should be physi- 
cally secured from access by unauthorized persons. 


In order to preserve the contents of a confidential 
mailbox during a power disruption, some users 
provide fax machines with a more permanent stor- 
age device such as a hard disk. The contents of a 
hard disk are not lost during power failures. 


Some organizations conduct a risk analysis on the 
type of information transmitted or received by fax. 
The entire organization or a particular branch that 
faxes sensitive or confidential personal information 
may become classified as “high risk”. Entities in 
such high risk categories will then be provided with 
fax machines with additional security features. 


Digitized by the Internet Archive 
in 2024 with funding from 
University of Toronto 


https://archive.org/details/31761118940998 


A PPENDIX: 
TABLES 


TABLE 1 


DISTRIBUTION OF FAX MACHINES 


MACHINES INSTITUTIONS 
NOR ES 

al 34 41 
2-4 tS 18 
So) 6 7 
10719 7 9 
20232 2 2 
40-59 6 7 
079 4 5 
80299 2 2 
TOURCAOVer vi 9 


TOTAL So 100 


TABLE 2 


INSTITUTIONS WITH A FAX POLICY 


MACHINES INSTITUTIONS HAD POLICY 

No. ESS 
“à 34 LS 38 
2-4 15 7 47 
59 6 5 50 
OT 7 3 43 
20259 2 “a 50 
40-59 6 2 LE 
COS 4 Dh 20 
0020 2 L 50 
OD Bite O Vier a 2 29 


TOTAL 83 33 40 


TABLE 3 


REVIEWED EXISTING PROCEDURES 


MACHINES INSTITUTIONS PROCEDURES 

No. _%_ 
1 34 17 ex) 
24 ps ©) 60 
59 6 5 50 
TOST9 a 4 517. 
20789 2 2 50 
AO = OO 6 3 50 
COST 4 a, 29 
80299 2 2 100 
BOOT Oy eis i 5 43 
TOTAL 83 43 52 


TABLE 4 


USEFUL WHEN DESIGNING NEW PROCEDURES 


MACHINES INSTITUTIONS USEFUL TEER 
No. i%- No. See 

L 2 RS Te 6 29 

2-4 10 8 80 2 20 
520 3 3 2LO0 (0) 0 
LOST 7 6 86 L 14 
20259 2 TOO (0) 0 
40559 4 4 100 (0) 0 
60279 2 2 Er OD 0 0 
50=99 2 200100 0 (0) 
100 & Over 5 ie) (0) (0) 
TOTAL 56 47 84 = 16 


TABLE 5 


INSTITUTIONS THAT REVIEWED OTHER AREAS 


REVIEWED 

MACHINES INSTITUTIONS OTHER AREAS 

No. Poe 
al 34 2 6 
24 5 ? 12e 
3-9 6 O O 
LO Lo a 2 29 
20289 2 al 310) 
40-59 6 2 33 
60-79 4 2 50 
80-99 2 if 50 
100 & Over 7 2 29 
TOTAL 83 14 ay, 


TABLE 6 


INSTITUTIONS THAT REVIEWED EXISTING FEATURES 


MACHINES INSTITUTIONS REVIEWED 
No. Eee 

ib 34 10 29 
2-4 LS 8 = 
Smt) 6 O O 
LOS LT 7 iy 14 
20=39 2 i 50 
20 ='5)9 6 4 67 
6079 4 2 50 
30-99 2 1 50 
10078 Over 7 5 at 
TOTAL 83 BZ 39 


TABLE 7 


USEFUL IN PURCHASING NEW MACHINES 


MACHINES INSTITUTIONS USEFUL 
Now er 
fh 34 dk By 
2-4 LS 8 59 
5-9 6 L 17 
LO 9 7 il 14 
20729 2 1 50 
40-59 6 À 67 
6O=7.9 4 3 (ies 
oH OFS ES) 2 O (@) 
100 & Over 7 5 el 
TOTAL 83 34 41 


TABLE 8 


OVER 50% OF FAX ACTIVITY WITH THIRD PARTIES 


MACHINES INSTITUTIONS OVER 50% 
No. % 

a 34 10 Zo 
2-4 L5 ) 60 
529 6 0 (0) 
LO =a. # L 14 
20-39 2 uf 50 
20-59 6 3 50 
60279 4 O O 
20799 2 O O 
LOO 2 7OVer 7 it 14 
TOTAL 83 Zo 50 
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